Strengthening Cyber Resiliency in a Time of Geopolitical Crises...
summary
Long-term monitoring of Russian forums and Telegram feeds feeds into a custom MISP CTI pipeline and an ACD Loop that pairs detection engineering with active cyber defense (honeypots, beacons, deception). The team emulates Sunborn/GRU tradecraft using Atomic Red Team and Caldera, models Hermetic wiper attacks, and runs risk analysis; initial detection success is ~28% and rises to 78.6% after tuning, 40 ATT&CK TTPs validated, 12 new alerts created and three blind spots closed.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 2:58Active cyber defense basics
- 9:30Research paradigm and methodology
- 13:16Threat actor analysis
- 21:03Case study: Sandworm
- 25:54The ACD loop process
- 33:07Results and validation
- 39:02Conclusions and takeaways
related talks
46mDeception Is on the Rise, But Is It Time to Unleash Engagement Operations?
01h 27mOpen-source Tools and CSIRT Success Stories
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
47mBear Necessities: Ukraine's Experience Facing APTs, Building Resilience
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
41mWhat We Can Learn from Ukraine's Cyber Defenders about Building a More Resilient Future